CVE-2019-10774 - php-shellcommand versions before 1.6.1 have a command injection vulnerability

CRITICAL

php-shellcommand versions before 1.6.1 have a command injection vulnerability

Published Dec 30, 2019

9.8

CRITICAL

CVSS 3.1

EPSS 4.63%

php-shellcommand versions before 1.6.1 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

PHP-Shellcommand

n/a

Version	Status	Constraints
All versions prior to version 1.6.1	affected	-

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3527		Advisory
https://github.com/advisories/GHSA-c7fv-wv9f-cgjw		Advisory
https://github.com/mikehaertl/php-shellcommand/commit/8d98d8536e05abafe76a491da87296d824939076
https://nvd.nist.gov/vuln/detail/CVE-2019-10774
https://snyk.io/vuln/SNYK-PHP-MIKEHAERTLPHPSHELLCOMMAND-538426		x_refsource_MISCExploitPatchThird Party Advisory